Hadoop Common
  1. Hadoop Common
  2. HADOOP-7189

Add ability to enable 'debug' property in JAAS configuration

    Details

    • Type: Improvement Improvement
    • Status: Resolved
    • Priority: Minor Minor
    • Resolution: Fixed
    • Affects Version/s: 0.22.0
    • Fix Version/s: 0.22.0
    • Component/s: security
    • Labels:
    • Hadoop Flags:
      Reviewed

      Description

      Occasionally users have run into weird "Unable to login" messages. Unfortunately, JAAS obscures the underlying exception message in many cases because it thinks leaking the exception might be insecure in itself. Enabling the "debug" option in the JAAS configuration gets it to dump the underlying issue and makes troubleshooting this kind of issue easier.

      1. enable-UGI-debug-example.txt
        2 kB
        Todd Lipcon
      2. HADOOP-7189.patch
        3 kB
        Andrew Whang
      3. HADOOP-7189.txt
        2 kB
        Ted Yu

        Activity

        Hide
        Todd Lipcon added a comment -

        this isn't a patch meant to actually be committed - but just shows the debug setting I'm talking about. This should be made conditional by a Java property or env var.

        Show
        Todd Lipcon added a comment - this isn't a patch meant to actually be committed - but just shows the debug setting I'm talking about. This should be made conditional by a Java property or env var.
        Hide
        Allen Wittenauer added a comment -

        I agree. This definitely looks like something that should get reformulated so that we could set it for debugging without rebuilding and/or (even worse) restarting the service.

        Show
        Allen Wittenauer added a comment - I agree. This definitely looks like something that should get reformulated so that we could set it for debugging without rebuilding and/or (even worse) restarting the service.
        Hide
        Ted Yu added a comment -

        This patch is based on Todd's patch.

        Introduced an environment variable to control the addition of debug option.

        Show
        Ted Yu added a comment - This patch is based on Todd's patch. Introduced an environment variable to control the addition of debug option.
        Hide
        Todd Lipcon added a comment -

        Looks good, though I would suggest using HADOOP_JAAS_DEBUG as the environment variable. Our convention is that env vars are ALL_CAPITAL_LETTERS, reserving dot.separated.words for conf options.

        Show
        Todd Lipcon added a comment - Looks good, though I would suggest using HADOOP_JAAS_DEBUG as the environment variable. Our convention is that env vars are ALL_CAPITAL_LETTERS, reserving dot.separated.words for conf options.
        Hide
        Andrew Whang added a comment -

        identical to HADOOP-7189.txt, but with test case

        Show
        Andrew Whang added a comment - identical to HADOOP-7189 .txt, but with test case
        Hide
        Ted Yu added a comment -

        Changed the name of environment variable according to Todd's suggestion.

        Show
        Ted Yu added a comment - Changed the name of environment variable according to Todd's suggestion.
        Hide
        Todd Lipcon added a comment -

        +1 for Ted's patch. Unfortunately I wasn't able to use the test that Andrew contributed, since this feature happens in a static initialization block and depends on an env var. I manually tested by running the UGI class from the command line with and without the env var set to "true".

        Show
        Todd Lipcon added a comment - +1 for Ted's patch. Unfortunately I wasn't able to use the test that Andrew contributed, since this feature happens in a static initialization block and depends on an env var. I manually tested by running the UGI class from the command line with and without the env var set to "true".
        Hide
        Todd Lipcon added a comment -

        Committed to 22 and trunk. Thanks, Ted!

        Show
        Todd Lipcon added a comment - Committed to 22 and trunk. Thanks, Ted!
        Hide
        Hudson added a comment -

        Integrated in Hadoop-Common-trunk-Commit #593 (See https://builds.apache.org/hudson/job/Hadoop-Common-trunk-Commit/593/)
        HADOOP-7189. Add ability to enable debug property in JAAS configuration. Contributed by Ted Yu.

        Show
        Hudson added a comment - Integrated in Hadoop-Common-trunk-Commit #593 (See https://builds.apache.org/hudson/job/Hadoop-Common-trunk-Commit/593/ ) HADOOP-7189 . Add ability to enable debug property in JAAS configuration. Contributed by Ted Yu.
        Hide
        Hudson added a comment -

        Integrated in Hadoop-Common-trunk #686 (See https://builds.apache.org/hudson/job/Hadoop-Common-trunk/686/)
        HADOOP-7189. Add ability to enable debug property in JAAS configuration. Contributed by Ted Yu.

        Show
        Hudson added a comment - Integrated in Hadoop-Common-trunk #686 (See https://builds.apache.org/hudson/job/Hadoop-Common-trunk/686/ ) HADOOP-7189 . Add ability to enable debug property in JAAS configuration. Contributed by Ted Yu.
        Hide
        Tsz Wo Nicholas Sze added a comment -

        Forgot to run tests and set fix versions?

        Show
        Tsz Wo Nicholas Sze added a comment - Forgot to run tests and set fix versions?
        Hide
        Todd Lipcon added a comment -

        Oops, sorry about the fix version. I did check the UGI tests locally before committing - sorry I didn't mention this.

        Show
        Todd Lipcon added a comment - Oops, sorry about the fix version. I did check the UGI tests locally before committing - sorry I didn't mention this.
        Hide
        Hudson added a comment -

        Integrated in Hadoop-Common-22-branch #49 (See https://builds.apache.org/hudson/job/Hadoop-Common-22-branch/49/)

        Show
        Hudson added a comment - Integrated in Hadoop-Common-22-branch #49 (See https://builds.apache.org/hudson/job/Hadoop-Common-22-branch/49/ )

          People

          • Assignee:
            Ted Yu
            Reporter:
            Todd Lipcon
          • Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development